Detections
Analytics

Alpine: gnutls: security update to 3.7.7-r1

high Tenable Cloud Security Plugin ID 404723

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - A timing side-channel in the handling of RSA ClientKeyExchange messages was discovered in GnuTLS. This
 side-channel can be sufficient to recover the key encrypted in the RSA ciphertext across a network in a
 Bleichenbacher style attack. To achieve a successful decryption the attacker would need to send a large
 amount of specially crafted messages to the vulnerable server. By recovering the secret from the
 ClientKeyExchange message, the attacker would be able to decrypt the application data exchanged over that
 connection. (CVE-2023-0361)

See Also

https://security.alpinelinux.org/vuln/CVE-2023-0361

Plugin Details

Severity: High

ID: 404723

Version: Revision 1.27

Type: Local

Published: 10/31/2023

Updated: 7/2/2026

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.3

Percentile: 53.37

CVSS v2

Risk Factor: High

Base Score: 7.1

Temporal Score: 5.6

Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:N

CVSS Score Source: CVE-2023-0361

CVSS v3

Risk Factor: High

Base Score: 7.4

Temporal Score: 6.7

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 2/13/2023

Reference Information

CVE: CVE-2023-0361